2319 matches found
CVE-2020-10196
An XSS vulnerability in the popup-builder plugin before 3.64.1 for WordPress allows remote attackers to inject arbitrary JavaScript into existing popups via an unsecured ajax action in com/classes/Ajax.php. It is possible for an unauthenticated attacker to insert malicious JavaScript in several o...
CVE-2020-10196: Improper Neutralization of Input During Web Page Generation
An XSS vulnerability in the popup-builder plugin before 3.64.1 for WordPress allows remote attackers to inject arbitrary JavaScript into existing popups via an unsecured ajax action in com/classes/Ajax.php. It is possible for an unauthenticated attacker to insert malicious JavaScript in several o...
PT-2020-7780
Name of the Vulnerable Software and Affected Versions: Netsweeper versions 3.1.x through 3.1.9 Netsweeper versions 4.0.x through 4.0.8 Netsweeper versions 4.1.x through 4.1.1 Description: A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the PATH...
PT-2020-20425
Name of the Vulnerable Software and Affected Versions Popup Builder plugin versions 2.2.8 through 2.6.7.6 Description The issue allows for SQL injection via PHP Deserialization on attacker-controlled data with the attachmentUrl POST variable in the sgImportPopups function in sg popup ajax.php. Th...
CVE-2012-2517
Cross-site scripting XSS vulnerability in PrestaShop before 1.4.9 allows remote attackers to inject arbitrary web script or HTML via the index of the product parameter to ajax.php...
Cross site scripting
Cross-site scripting XSS vulnerability in PrestaShop before 1.4.9 allows remote attackers to inject arbitrary web script or HTML via the index of the product parameter to ajax.php...
CVE-2012-2517
Cross-site scripting XSS vulnerability in PrestaShop before 1.4.9 allows remote attackers to inject arbitrary web script or HTML via the index of the product parameter to ajax.php...
CVE-2012-2517
CVE-2012-2517 is an XSS vulnerability in PrestaShop before 1.4.9. The issue arises from unsanitized input in the POST/parameter named product[] to ajax.php , allowing remote attackers to inject arbitrary HTML/JS. Reported impact is cross-site scripting with potential execution in the administrato...
CVE-2012-2517: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in PrestaShop before 1.4.9 allows remote attackers to inject arbitrary web script or HTML via the index of the product parameter to ajax.php...
PT-2020-7205
Name of the Vulnerable Software and Affected Versions PrestaShop versions prior to 1.4.9 Description The issue allows remote attackers to inject arbitrary web script or HTML via the index of the product parameter to "ajax.php" API endpoint. This is a cross-site scripting XSS issue. Recommendation...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in the Photo Gallery plugin before 1.2.11 for WordPress allow remote authenticated users to inject arbitrary web script or HTML via the 1 sortby, 2 sortorder, 3 itemsview, 4 dir, 5 clipboardtask, 6 clipboardfiles, 7 clipboardsrc, or 8 clipboarddes...
CVE-2015-1394
The CVE-2015-1394 entry corresponds to multiple XSS vulnerabilities in the WordPress plugin Photo Gallery (before 1.2.11). The vulnerability allows remote authenticated users to inject arbitrary JavaScript/HTML via parameters (sort_by, sort_order, items_view, dir, clipboard_task, clipboard_files,...
CVE-2015-1394
Multiple cross-site scripting XSS vulnerabilities in the Photo Gallery plugin before 1.2.11 for WordPress allow remote authenticated users to inject arbitrary web script or HTML via the 1 sortby, 2 sortorder, 3 itemsview, 4 dir, 5 clipboardtask, 6 clipboardfiles, 7 clipboardsrc, or 8 clipboarddes...
PT-2020-7802
Name of the Vulnerable Software and Affected Versions: WordPress Photo Gallery plugin versions prior to 1.2.11 Description: The issue allows remote authenticated users to inject arbitrary web script or HTML via certain parameters in an addImages action to the "wp-admin/admin-ajax.php" API endpoin...
CVE-2015-1394: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in the Photo Gallery plugin before 1.2.11 for WordPress allow remote authenticated users to inject arbitrary web script or HTML via the 1 sortby, 2 sortorder, 3 itemsview, 4 dir, 5 clipboardtask, 6 clipboardfiles, 7 clipboardsrc, or 8 clipboarddes...
Tutor LMS < 1.5.3 - Cross-Site Request Forgery (CSRF)
Tutor LMS WordPress plugin is vulnerable to Cross-Site Request Forgery CSRF attacks. As the requests for the approval and blocking of instructors are sent using the GET method, the CSRF attack to approve an attacker-controlled instructor account can be performed by having the admin visit...
CVE-2020-7104
The chained-quiz plugin 1.1.8.1 for WordPress has reflected XSS via the wp-admin/admin-ajax.php totalquestions parameter...
Cross site scripting
The chained-quiz plugin 1.1.8.1 for WordPress has reflected XSS via the wp-admin/admin-ajax.php totalquestions parameter...